I’m excited to share something I’ve built: CTF Training, a hands-on, 10-part Capture the Flag curriculum, now public on GitHub.
It’s designed to take someone from “what’s a flag?” to competing as a team under a clock — and it maps directly onto what you’ll see in National Cyber League, US Cyber Games, and collegiate CTFs.
What’s Inside
Ten modules, one per day, each a self-contained README that’s both lesson and lab:
- Modules 1–2: CTF fundamentals, Linux & the command line
- Modules 3–4: Cryptography essentials and web exploitation (SQLi, XSS, JWTs)
- Modules 5–6: Packet analysis and digital forensics (Autopsy, Sleuth Kit, deleted-file recovery)
- Module 7: Reverse engineering (Ghidra, objdump, XOR obfuscation)
- Module 8: Team strategy
Every module pairs a plain-language explanation with verified, hands-on challenges, so you learn a technique and immediately put it to use. The difficulty ramps within each day, so mixed-skill teams stay engaged together.
Why Public
The public READMEs are answer-free — solving them is the point. I also maintain a separate, private instructor/coach repository with harder and more unique challenges, along with full instructor walkthroughs and answer keys, available to professors, instructors, or coaches. If your an instructor/coach you’d like access, please reach out.
My hope is that this is useful to professors, instructors, and coaches building CTF skills for competition or for real-world DFIR and incident response work.
Check out CTF Training on GitHub
If you’re a professor, instructor, or coach and would like access to the private repo, reach out to me directly.
Found it useful? A ⭐ on the repo helps others find it. Have a challenge idea or want to contribute? Open an issue or reach out — I’d love to grow this with the community!